CVE-2023-3971 : An HTML injection flaw was found in Controller in the user interface settings. T

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Published 2023-10-04 15:15:12

Updated 2023-10-10 19:11:16

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2023-3971

Redhat » Ansible Automation Platform » Version: 2.3
cpe:2.3:a:redhat:ansible_automation_platform:2.3:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 8.0
When used together with: Redhat » Enterprise Linux » Version: 9.0
Redhat » Ansible Automation Platform » Version: 2.4
cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 8.0
When used together with: Redhat » Enterprise Linux » Version: 9.0
Redhat » Ansible Automation Controller
Versions before (<) 4.3.11
cpe:2.3:a:redhat:ansible_automation_controller:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Automation Controller » Version: 4.4
cpe:2.3:a:redhat:ansible_automation_controller:4.4:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Developer » Version: 1.0
cpe:2.3:a:redhat:ansible_developer:1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 8.0
When used together with: Redhat » Enterprise Linux » Version: 9.0
Redhat » Ansible Inside » Version: 1.1
cpe:2.3:a:redhat:ansible_inside:1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 8.0
When used together with: Redhat » Enterprise Linux » Version: 9.0

Exploit prediction scoring system (EPSS) score for CVE-2023-3971

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3971

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	2.1	5.2	Red Hat, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2023-3971

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-3971

https://access.redhat.com/errata/RHSA-2023:4340

RHSA-2023:4340 - Security Advisory - Red Hat Customer Portal
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4590

RHSA-2023:4590 - Security Advisory - Red Hat Customer Portal
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-3971

CVE-2023-3971- Red Hat Customer Portal
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2226965

2226965 – (CVE-2023-3971) CVE-2023-3971 Controller: Html injection in custom login info
Issue Tracking;Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-3971

Products affected by CVE-2023-3971

Exploit prediction scoring system (EPSS) score for CVE-2023-3971

CVSS scores for CVE-2023-3971

CWE ids for CVE-2023-3971

References for CVE-2023-3971